Main Vulnerability Database Vulnerabilities #VU22710

Input validation error in Microsoft Windows and Windows Server - CVE-2019-1456

Published: November 12, 2019

Vulnerability identifier: #VU22710

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1456

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Windows Adobe Type Manager Library handles specially crafted OpenType fonts. A remote attacker can create a specially crafted web page or document with embedded malicious font, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2019-1456

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1456

Related Security Bulletins